Makes high-risk automated decisions, in the Economic Community of West African States

ECOWAS Supplementary Act A/SA.1/01/10, arts. 3 to 5, 14, 20, 23 to 25, 28 to 30, 34, 35, 43 and 48, general regime · Read the law's page

• As a data controller or processor handling personal data in an ECOWAS Member State, declare the processing to the national data protection Authority, except in the cases the Act exempts, and obtain consent or another ground Article 23 lists.
• Obtain personal data only for specified, explicit and lawful purposes and do not process it further in a manner incompatible with those purposes.
• Do not obtain or process data that reveals racial, ethnic or regional origin, political opinions, religious or philosophical beliefs, trade union membership, sexual life, genetic data or health, except in a case Article 31 lists.
• Do not use an individual's personal data for direct prospecting by any means of communication without the individual's prior consent.
• Do not base a decision that has legal effect on an individual solely on automatic processing of personal data that defines the individual's profile or evaluates aspects of personality.
• Keep personal data confidential and protected, and take all necessary precautions so that it is not deformed, damaged or accessible to unauthorised third parties.
• Where processing is carried out on your behalf, choose a data processor that provides sufficient guarantees.